codex-auth

Run `scripts/codex_auth.py` to generate a login URL and apply callback URL tokens to `auth-profiles.json`.

## Safe defaults
- Treat callback URLs/tokens as sensitive and never echo full values.
- Use queued apply flow for controlled restart behavior.
- See `RISK.md` for allowed/denied operation boundaries.

## Commands
- `/codex_auth` → selector (discovered profiles)
- `/codex_auth <profile>`
- `/codex_auth finish <profile> <callback_url>`

## Interaction adapter
- If inline buttons are supported: show selector buttons.
- If inline buttons are not supported: send text fallback (`default | <profile>`).
- Callback message handling must never echo full callback URLs (treat as sensitive).
- Use callback_data namespace prefix `codex_auth_*` to avoid collisions.

## How to run
Start flow:

```bash
python3 skills/codex-auth/scripts/codex_auth.py start --profile default
```

Finish flow (after browser redirect URL is pasted):

```bash
python3 skills/codex-auth/scripts/codex_auth.py finish --profile default --callback-url "http://localhost:1455/auth/callback?code=...&state=..."
```

Queue safe apply (stops/restarts gateway in background):

```bash
python3 skills/codex-auth/scripts/codex_auth.py finish --profile default --callback-url "http://localhost:1455/auth/callback?code=...&state=..." --queue-apply
python3 skills/codex-auth/scripts/codex_auth.py status
```

## Safety posture
- No remote shell execution (`curl|bash`, `wget|sh`) is allowed by this skill.
- No `sudo`/SSH/system package mutation is performed by this skill.
- OAuth callback URLs are sensitive: never echo full callback URLs or tokens in chat output.
- Writes are limited to auth profile state files with lock-based coordination.

## Notes
- Uses the same OpenAI Codex OAuth constants/method as OpenClaw onboarding (`auth.openai.com` + localhost callback).
- OAuth success here does not guarantee `chatgpt.com/backend-api/wham/usage` acceptance; usage endpoint may reject token/session format with `401` and should b...